CCST Wireless Security Protocols (WPA) 2 — Questions and Answers
Question 1: What encryption algorithm does WPA2-Personal use?
- RC4
- AES-CCMP (Correct answer)
- TKIP
- DES
Correct answer: AES-CCMP
WPA2 uses AES-CCMP providing strong 128-bit encryption for wireless data frames.
AES-CCMP provides confidentiality (Counter Mode) and integrity/authentication (CBC-MAC). Uses 128-bit key and block size with unique per-packet keys. WPA2-Personal uses PSK; Enterprise uses 802.1X/RADIUS.
Question 2: What is the main weakness of WPA2-Personal that WPA3 addresses?
- WPA2 does not encrypt data
- The PSK four-way handshake is vulnerable to offline dictionary attacks (Correct answer)
- WPA2 does not support 5 GHz
- WPA2 only works with older devices
Correct answer: The PSK four-way handshake is vulnerable to offline dictionary attacks
The captured four-way handshake can be brute-forced offline. WPA3's SAE eliminates this vulnerability.
Attacker captures handshake (or forces new one via deauth), then tests millions of passwords offline with Hashcat. WPA3 SAE uses zero-knowledge proof preventing offline extraction, plus provides forward secrecy.
Question 3: What is the purpose of 802.1X in WPA2-Enterprise?
- To increase signal range
- To provide individual user authentication through a RADIUS server (Correct answer)
- To enable faster speeds
- To reduce access points needed
Correct answer: To provide individual user authentication through a RADIUS server
802.1X authenticates each user individually via RADIUS using credentials or certificates.
Three parties: supplicant (client), authenticator (AP), authentication server (RADIUS). EAP methods: PEAP (password), EAP-TLS (certificates, most secure). Benefits: individual accountability, unique session keys, centralized access management.
Question 4: What is a rogue access point and how does it threaten wireless security?
- A misconfigured AP that drops traffic
- An unauthorized AP that can intercept traffic or provide attackers network access (Correct answer)
- An AP with outdated firmware
- An AP supporting only WEP
Correct answer: An unauthorized AP that can intercept traffic or provide attackers network access
Rogue APs are unauthorized devices that bypass network security and can intercept traffic.
Types: evil twin (mimics legitimate SSID) and employee-connected personal APs. Detection: WIPS, 802.1X port security, wireless surveys. Prevention: security policies, awareness training, switch port security.
Question 5: What is the difference between WPA2-TKIP and WPA2-AES modes?
- No difference
- TKIP uses older, weaker encryption for backward compatibility; AES uses stronger AES-CCMP (Correct answer)
- TKIP is faster
- AES only works on 5 GHz
Correct answer: TKIP uses older, weaker encryption for backward compatibility; AES uses stronger AES-CCMP
TKIP provides backward compatibility with weaker RC4-based encryption; AES-CCMP is the mandatory, stronger option.
TKIP has known weaknesses (Beck-Tews, Ohigashi-Morii attacks). Configure AES-only mode and retire TKIP-only devices. Using TKIP degrades both performance and security.
Question 6: What is Protected Management Frames (PMF) and why is it important?
- A feature increasing signal strength
- A mechanism encrypting management frames to prevent deauthentication attacks (Correct answer)
- A protocol for managing multiple APs
- A method for prioritizing management traffic
Correct answer: A mechanism encrypting management frames to prevent deauthentication attacks
PMF (IEEE 802.11w) protects management frames from spoofing, preventing deauthentication attacks.
Without PMF, attackers trivially forge deauth frames. PMF uses session keys to encrypt and authenticate management frames. Optional in WPA2, mandatory in WPA3, closing a commonly exploited attack vector.
CCST Wireless Security Protocols (WPA) 2
What encryption algorithm does WPA2-Personal use?